‍

between

you as a customer

(as the person responsible - hereinafter referred to as the "Client")

and

circuly GmbH, Obernstraße 50, 33602 Bielefeld, Germany

(as a processor of orders - hereinafter referred to as "Contractor" )

Customer  and Contractor hereinafter each also referred to as "Party" and jointly as "Parties”

Preamble

The Contractor provides services for the Client in the area of business transactions in accordance with the user contract concluded between them (hereinafter referred to as the "Main Contract"). Part of the execution of the main contract is the processing of personal data within the meaning of the General Data Protection Regulation (“GDPR”, in German: "DSGVO"). In order to meet the requirements of the GDPR for such a set of services, the parties shall conclude the following contract processing agreement, which shall come into effect upon signature of the main contract (contract of usage).

§ 1 Subject/scope of the assignment

(1) Within the scope of the cooperation of the parties in accordance with the main contract, the contractor has access to personal data of the end customer (hereinafter referred to as "customer data"). The Contractor shall process this customer data on behalf of and in accordance with the instructions of the Client in accordance with Art. 4 No. 8 and Art. 28 GDPR or any equivalent replacement or updated legislation.

(2) The processing of the customer data by the Contractor shall be carried out in the manner described in Annex 1 and to the extent and for the purpose specified therein. The group of persons affected by the data processing is shown. The duration of the processing corresponds to the term of the main contract. Whether the Contractor's services are suitable for the processing of special categories of personal data pursuant to Art. 9 (1) DSGVO requires a risk assessment by the Client.

(3) The Client is prohibited from processing customer data in a manner deviating from the processing specified in Annex 1.

(4) The processing of the customer data shall generally take place in the territory of the Federal Republic of Germany, in a member state of the European Union or in another state party to the Agreement on the European Economic Area. Should there be a relocation of the commissioned processing to a third country, this shall require the prior consent of the Client and shall only take place if the special requirements of Art. 44 to 49 DSGVO are met. The Client already consents to the processing of personal data by the subcontractors named in Annex 1 upon conclusion of this commissioned processing agreement.

(5) The provisions of this contract shall apply to all activities related to the main contract. The same shall apply to all activities in which the Contractor and its employees or persons commissioned by the Contractor come into contact with customer data.

§ 2 Powers of instruction of the client

(1) The Contractor shall process the Client Data within the scope of the commission and on behalf of and in accordance with the instructions of the Client within the meaning of Art. 28 DSGVO (commissioned processing). The Client has the sole right to issue instructions on the type, scope and method of the processing activities (hereinafter also referred to as "right to issue instructions"). If the Contractor is required by the law of the European Union or the Member States to which it is subject to carry out further processing, it shall notify the Client of these legal requirements prior to the processing.

(2) Instructions shall generally be issued by the Client in writing or in electronic form (e-mail is sufficient); instructions issued verbally shall be confirmed by the Contractor in electronic form.                              

(3) If the Contractor is of the opinion that an instruction of the Client violates data protection provisions, it shall notify the Client thereof. The Contractor shall be entitled to suspend the implementation of the relevant instruction until it is confirmed or amended by the Client.

§ 3 Contractor's protective measures

(1) The Contractor shall be obligated to observe the statutory provisions on data protection and not to disclose information obtained from the Client's domain to third parties or expose it to their access. Documents and data shall be secured against disclosure to unauthorized persons, taking into account the state of the art.

(2) Furthermore, the Contractor shall oblige all persons entrusted by it with the processing and fulfillment of this Agreement (hereinafter referred to as "Employees") to maintain confidentiality (obligation to maintain confidentiality, Art. 28 Para. 3 lit. b DSGVO). Upon request of the Client, the Contractor shall provide the Client with evidence of the obligation of the Employees in writing or in electronic form.

(3) The Contractor shall design its internal organization in such a way that it meets the special requirements of data protection. It undertakes to take all appropriate technical and organizational measures for the adequate protection of the Customer Data pursuant to Art. 32 DSGVO, in particular the measures listed in Annex 2 to this Agreement, and to maintain them for the duration of the processing of the Customer Data.

(4) The Contractor reserves the right to change the technical and organizational measures taken, while ensuring that the contractually agreed level of protection is not undercut.

(5) At the request of the Client, the Contractor shall provide the Client with evidence of compliance with the technical and organizational measures.

§ 4 Information and support obligations of the contractor

(1) In the event of disruptions, suspicion of data protection violations or violations of contractual obligations of the Contractor, suspicion of security-relevant incidents or other irregularities in the processing of the Customer Data by the Contractor, persons employed by it within the scope of the contract or by third parties, the Contractor shall inform the Client in writing or electronically without undue delay, but no later than within 48 hours. The same shall apply to audits of the Contractor by the data protection supervisory authority. These notifications should in each case contain at least the information specified in Art. 33(3) DSGVO.

(2) In the aforementioned case, the Contractor shall support the Client in the fulfillment of its educational, remedial and informational measures in this regard to the extent reasonable.

(3) The Contractor undertakes to provide the Client, at the latter's request and within a reasonable period of time, with all information and evidence required to carry out an inspection.

§ 5 Other obligations of the contractor

(1) If the requirements of Art. 30 GDPR apply to the Contractor, the Contractor shall be obliged to keep a register of all categories of processing activities carried out on behalf of the Client pursuant to Art. 30 (2) GDPR. The directory shall be made available to the Customer upon request.

(2) The Contractor shall be obliged to support the Client in the preparation of a data protection impact assessment pursuant to Art. 35 GDPR and any prior consultation with the supervisory authority pursuant to Art. 36 GDPR.

(3) The Contractor confirms that it has appointed a data protection officer - insofar as there is a legal obligation to do so.

(4) Should the Customer Data at the Contractor be endangered by attachment or seizure, by insolvency or composition proceedings or by other events or measures of third parties, the Contractor shall inform the Client thereof without undue delay, unless it is prohibited from doing so by court or administrative order. In this context, the Contractor shall immediately inform all competent bodies that the decision-making authority over the data lies exclusively with the Client as the "responsible party" within the meaning of the GDPR.

§ 6 Subcontracting

(1) The Contractor may have the Processing of Personal Data performed in whole or in part by additional Processors (hereinafter "Subcontractors"). The Contractor shall inform the Client in text form in good time in advance about the commissioning of subcontractors or changes in the subcontracting. The Customer may object to the subcontracting in text form within four weeks of becoming aware of it if there are objective reasons for doing so.

(2) A subcontractor relationship within the meaning of these provisions shall not exist if the Contractor commissions third parties with services which are to be regarded as purely ancillary services. These include, for example, postal, transport and shipping services, cleaning services, security services, telecommunication services without any specific reference to services provided by the Contractor to the Client as well as other measures to ensure the confidentiality, availability, integrity and resilience of the hardware and software of data processing systems. The obligation of the Contractor to ensure compliance with data protection and data security also in these cases shall remain unaffected.

(3) The Contractor shall agree with the subcontractor on the content of the provisions made in this Agreement. In particular, the TOM (Technical and Organizational Measures) to be agreed with the subcontractor must provide an equivalent level of protection.

(4) The Contractor has established subcontractor relationships with the companies listed in Annex 1, to which the Customer consents upon conclusion of this Agreement.

(5) The Contractor has concluded order processing agreements with the subcontractors in accordance with the requirements of Section 6 (3). The Customer shall approve the aforementioned subcontractors upon this Agreement becoming effective.

Part of the order processing agreements with the subcontractors is in particular that the subcontractors ensure that they have taken appropriate and suitable technical and organizational measures in accordance with Art. 32 GDPR with regard to the processing of personal data carried out by them on behalf.

§ 7 Control rights

(1) The customer is entitled to regularly satisfy himself that the regulations of this contract are being observed. For this purpose, he may, for example, obtain information from the contractor, have existing attestations from experts, certifications or internal tests presented to him or have the contractor's technical and organizational measures checked personally or by a competent third party during normal business hours, provided that the latter is not in a competitive relationship with the contractor.

(2) The Customer shall only carry out inspections to the extent necessary and shall take appropriate account of the Contractor's operating procedures. The parties shall agree on the time and type of inspection in good time.

(3) The customer shall document the results of the inspection and notify the contractor. In the event of errors or irregularities which the Customer discovers, in particular during the inspection of order results, he must inform the Contractor without delay. If the inspection reveals facts whose future avoidance requires changes to the ordered procedure, the Customer shall inform the Contractor immediately of the necessary procedural changes.

§ 8 Rights of affected persons

(1) The Contractor shall support the customer as far as possible with suitable technical and organisational measures in the fulfilment of the customer’s obligations under Articles 12 to 22 and Articles 32 to 36 GDPR. He shall provide the Customer with the requested information on Customer data without delay, but at the latest within 14 working days, unless the Customer himself has the relevant information at his disposal.

(2) If the person concerned asserts his rights in accordance with Art. 16 to 18 GDPR, the Contractor is obliged to correct, delete or restrict the customer’s data on the customer’s instructions without delay, at the latest within a period of 7 working days. The Contractor shall provide the customer with written proof of the deletion, correction or restriction of the data upon request.

(3) If a data subject asserts rights, such as the right to information, correction or deletion of his data, directly against the contractor, the contractor will forward this request to the customer and awaits his instructions. Without such individual instructions, the Contractor shall not contact the data subject.

§ 9 Duration and termination

The term of this agreement corresponds to the term of the main agreement. If the main contract can be terminated in an orderly manner, the provisions on orderly termination shall apply accordingly.

§ 10 Cancellation and return after contract end

(1) After termination of the main contract or at any time at the request of the Customer, the Contractor shall return to the Customer all documents, data and data carriers made available to him or, at the request of the Customer, delete them completely and irrevocably, unless a statutory retention period exists. This shall also apply to copies of the Customer's data at the Contractor's premises, such as data backups, but not to documentation that serves to prove that the Customer's data has been processed in accordance with the order and in the proper manner. Such documentation shall be kept by the Contractor for a period of 6 months and shall be handed over to the customer upon request.

(2) The Contractor shall confirm the deletion to the customer electronically. The Customer has the right to control the complete and contractually compliant return or deletion of the data at the Contractor in a suitable manner.

(3) The Contractor shall be obliged to treat confidentially the data which have become known to him in connection with the main contract even after the end of the main contract.

§ 11 Liability

(1) The liability of the parties is governed by Art. 82 GDPR. Any liability of the Contractor towards the customer due to breach of obligations arising from this contract or the main contract remains unaffected.

(2) The parties shall each release themselves from liability if a party proves that it is not responsible in any respect for the circumstance as a result of which the damage occurred to an affected party. This shall apply mutatis mutandis in the case of a fine imposed on a party, whereby the indemnification shall be made to the extent that the respective other party bears a share of the responsibility for the violation sanctioned by the fine.

§ 12 Confidentiality & data security

(1) The Contractor undertakes to observe the same rules for the protection of secrets as are incumbent on the Client.

(2) There shall be a duty of confidentiality for the Contractor's employees and third parties commissioned by the Contractor. The Contractor shall impose a written confidentiality obligation on the persons employed in the processing of Client Data pursuant to Art. 28 (3) lit. b DSGVO. This is not necessary if the persons employed are already subject to an appropriate statutory duty of confidentiality. The Contractor shall document the obligation set forth in this clause in writing and submit it to the Client upon the Client’s request.

(3) The Contractor confirms that it is aware of the relevant data protection regulations. The Contractor warrants that it will familiarize the employees engaged in the performance of the work with the data protection provisions applicable to them and that it will oblige them to comply with the applicable data protection provisions. He shall monitor compliance with the data protection regulations.

(4) The confidentiality obligations regulated in this clause shall continue to apply after termination of the contractual relationship.

(5) Furthermore, in addition to the applicable statutory provisions (in particular § 88 TKG, § 203 StGB, §§ 4, 23 GeschGehG and, if applicable, special professional confidentiality obligations), the Contractor shall also be obligated to keep secret and not disclose to third parties all information and data of which it becomes aware within the scope of the contractually agreed services (confidential information). Confidential information is in particular business and trade secrets, contract conclusions, technical or commercial information of any kind or other information which is designated as confidential or which by its nature is to be regarded as confidential. This also applies in particular to:

Names, addresses as well as the personal, legal and economic circumstances of all customers of the Client and the personal, legal and economic circumstances of the Client and all other persons working for the Client.

Information shall not be considered confidential if it was already publicly known at the time the information came to the knowledge of the Contractor. Likewise, information that has become publicly known or has been made publicly known at a later time with the consent of the Client shall not be considered confidential.

The Contractor undertakes to oblige all employees who gain knowledge of the aforementioned confidential information of the Client in the course of their work for the Client to do the same as himself.

(6) If the Contractor commissions third parties, it shall ensure that the requirements of paragraphs 1 to 5 are implemented accordingly.

§ 13 Final provisions

(1) The parties agree that the defence of a right of retention by the contractor in the sense of § 273 BGB (German Civil Code) with regard to the data to be processed and the associated data carriers is excluded.

(2) Changes and amendments to this agreement must be made in electronic form.

(3) In case of doubt, the provisions of this agreement shall take precedence over the provisions of the main contract. Should individual provisions of this agreement prove to be wholly or partially invalid or unenforceable or become invalid or unenforceable as a result of changes in legislation after conclusion of the contract, the validity of the remaining provisions shall not be affected. The invalid or unenforceable provision shall be replaced by a valid and enforceable provision which comes as close as possible to the meaning and purpose of the invalid provision.

(4) This agreement is subject to German law. Exclusive place of jurisdiction is the registered office of the contractor.

‍

‍

Annexes  

Annex 1       Specifications to the contract

Annex 2       Technical and organisational measures taken by the Contractor (Art. 32 GDPR)

‍

‍

‍

Annex 1       Specifications to the contract

 Subject and duration of the order

Overview of requirements and specifications

(1) Main contract

Licence contract

(2) Subject of the order

Processing of data from the client and their end customers in a software that enables companies to also rent out their products instead of just selling them. The software is a white-label solution that creates a customer-centric rental experience along the entire value chain in the rental model.

(3) Purpose of data collection, data processing or data use

In order to fulfill the obligations of the Contractor arising from the main contract, personal data from the Client's sphere of control shall be processed by the Contractor to the full extent within the meaning of Art. 4 No. 2 of the German Data Protection Regulation (DSGVO), in particular collected, stored, changed, read out, queried, used, disclosed, compared, linked and deleted as necessary in each case. The purpose of the processing thus depends on the respective order described in the main contract.

(4) Type of data

The categories of personal data concerned by the processing depend on the use of the Contractor's services by the Client. The categories of data that may be considered as the subject of processing are the Client Data mentioned below. A final list of all data processed by the Contractor and Client Data is attached to the Description of Services at https://www.circuly.io/specification-of-services.

- End customer data (name, email, phone number, address and any other data that is put in the circuly checkout)

- Payment data (API key of the payment service provider, payment method, payment token if applicable)

- Connection data (API key of the store system),

- Usage data (e.g. history of web services, access times),

- Connection data (e.g. device ID, IP addresses, URL referrers), and

- Admin data (employee name, role, email, password).

(5) Circle of affected persons

The categories of data subjects concerned by the processing depend on the use of the Contractor's services by the Client. The categories of data subjects that may be considered are:

- Employees

- Trainees and interns

- Customers / Interested parties                        

- Suppliers and service providers    

- Business partners

Subcontractor

No.

Name of the subcontractor Address / Country

Subject of the order

Nature and scope of the data

1

Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg

Provision of SaaS services

See above for the subject of the order, hosted on servers within the EU.

2

Heroku, a Service from Salesforce.com Sarl, Route de la Longeraie 9, Morges, 1110, Switzerland

Provision of SaaS services

See above for the subject of the order, hosted on servers within the EU.

3

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany,

Provision of SaaS services

See above for the subject of the order, hosted on servers within Germany.

4

Mailgun Technologies Inc., E Pecan St. 110, San Antonio, 78205, Mexico

Provision of SaaS services

See above for the subject of the order, hosted on servers within the EU.

5

Google LLC, Amphitheatre Pkwy., 1600, Mountain View, California, 94035, USA

Provision of SaaS services, Google Places, validation of addresses in circuly Checkout (optional)

See above for the subject of the order, hosted in USA.

6

‍Lipsia Digital GmbH, Reichsstraße 1-9, 04109 Leipzig, Germany

Development of Shop System (where applicable)

See above for the subject of the order, hosted in Germany.

7

CRIF GmbH, Ndl. Karlsruhe, Kaiserstraße 217, 76133 Karlsruhe,Germany

Provision of SaaS services, credit check (where applicable, with separate agreement only)

See above for the subject of the order, hosted on servers within the EU.

‍

‍

Annex 2       Technical and organisational measures taken by the Contractor (Art. 32 GDPR)

Pursuant to Article 32 of the GDPR, data controllers are obliged to take technical and organizational measures to ensure the security of the processing of personal data. Measures must be selected in such a way that, taken together, they ensure an appropriate level of protection. Against this background, this overview explains which concrete measures have been taken by the Contractor with regard to the processing of personal data in the specific case.

Instructions on technical and organizational measures

1. Organisation of Information Security

Policies, processes and responsibilities must be defined to implement and control information security.

Measures:

☒ Definition of roles and responsibilities for application and system operation, data protection, and information security.

☒ Obligation of employees to maintain confidentiality and data secrecy.

☒ Regular implementation of training and awareness measures.

2. Privacy by Design

Privacy by design includes the idea that systems should be designed and constructed in such a way that the amount of personal data processed is minimized. Essential elements of data economy are the separation of personal identifiers and content data, the use of pseudonyms, and anonymization. In addition, the deletion of personal data must be implemented in accordance with a configurable retention period.

Measures:

☒ No more personal data is collected than is necessary for the respective purpose.

☒ Process to ensure privacy by design when introducing or modifying systems and applications.

☒ The processing operations and systems are designed in such a way that they enable and ensure deletion of the personal data processed in compliance with the GDPR.

3. Privacy by Default

Privacy by Default refers to the privacy-friendly default settings / standard settings.

Measures:

☒ Tracking functions that monitor the data subject are disabled by default.

☒ All default settings for selection options meet the requirements of the GDPR with regard to privacy-friendly default settings (e.g., no default settings for opt-ins).

4. Access control

Measures to ensure that those authorized to use the data processing procedures can only access the personal data or information and data requiring protection that are subject to their access authorization (description of security mechanisms inherent in the system, encryption procedures in accordance with the state of the art. In the case of online access, it shall be made clear which side is responsible for issuing and managing access security codes). The Contractor shall ensure that users authorized to use IT infrastructure can only access content for which they are authorized and that personal data cannot be copied, modified or deleted without authorization during processing and after storage.

Measures:

☒ Authorization concepts documented.

☒ Avoidance of group users.

☒ Access to data is restricted and only possible for authorized persons.

☒ Number of administrators reduced to the "bare minimum".

☒ Regular review of authorizations.

5. Cryptography and / or pseudonymization

Use of encryption procedures to ensure the proper and effective protection of the confidentiality, authenticity or integrity of personal data or information requiring protection.

Measures that are likely to make identification of the data subject difficult.

Measures:

☒ Encryption of end devices (PC, laptop, smartphones).

☒ Encrypted storage of personal data.

☒ Encryption of access to network access and connections.

☒ Use of pseudonyms, procedures for pseudonymization and anonymization of data. We work with the AES-256 advanced encryption standard, which is considered a particularly secure standard.

6. Building protection

Preventing unauthorized physical access to, damage to and impairment of the organization's information and information processing equipment. The Contractor shall take measures to prevent unauthorized persons from gaining access (to be understood spatially) to data processing equipment with which personal data are processed.

The contractor and all his employees and freelancers work fully remotely. This means that there is no specific building in which the employees and freelancers are obligated to perform their services. All employees and freelancers have been extensively committed to the obligation of data protection as well as confidentiality in a manner that is commensurate with the level of protection of this contract as well as its annexes.

7. Protection of operating resources / information assets

Prevention of loss, damage, theft or impairment of assets and disruption of the organization's operations.

Measures:

☒ Placement of server components in secured rooms, cabinets, etc. (Cloud)

Corresponding measures are carried out by our subcontractors whose SaaS services we use.

8. Operating procedures and responsibilities

Ensure proper and secure operation of systems and procedures for processing information.

Measures:

☒ Clear assignment of responsibilities for system and application support.

☒ Separation of the processing of data from the individual clients.

☒ Separation of development, test, and production systems.

☒ Monitoring of system operation.

9. Data security

Measures to ensure that personal data or information and data requiring protection are protected against accidental destruction or loss.

Measures:

☒ Data backup concept with regular backups.

☒ Outsourcing of backups to other fire zones.

☒ Outsourcing of backups to other buildings.

10. Malware protection and patch management

Preventing exploitation of technical vulnerabilities by using up-to-date antivirus software and implementing patch management.

Measures:

☒ Regular monitoring of the status of security updates and system vulnerabilities.

☒ Regularly apply security patches and updates.

11. Logging and monitoring

Measures to ensure that it is possible to check and determine retrospectively whether and by whom personal data has been entered into, modified or removed from IT systems.

Measures:

☒ Logging of activities of system administrators.

☒ Monitoring of system usage.

☒ Logging of accesses.

12. Networks Security Management

Adequate protection for the network must be implemented so that the information and infrastructure components are protected.

Corresponding measures are carried out by our subcontractors whose SaaS services we use.

13. Information transmission

Measures to ensure that personal data or information requiring protection and data cannot be read, copied, modified or removed by unauthorized persons during electronic transmission or during their transport or storage on data carriers, and that it is possible to check and determine to which bodies a transmission of personal data or information requiring protection and data is intended by data transmission facilities.

(Description of the facilities and transmission protocols used, e.g. identification and authentication, encryption in accordance with the state of the art, automatic call-back, etc.).

Measures:

☒ Disclosure of data to third parties only after verification of the legal basis.

☒ Legality and proper definition of the transfer of data to third countries.

☒ Secure data transmission between client and server.

☒ Appropriate protection of emails containing sensitive information / data.

☒ Use of encrypted external access.

14. Acquisition, development and maintenance of systems

Measures to ensure that information security is an integral part across the information systems lifecycle.

Measures:

☒ Definition of regulations for the development and adaptation of software and systems.

☒ Guidelines for safe system development.

☒ Monitoring of outsourced system development activities.

☒ Protection of test data.

Corresponding measures are also carried out by our subcontractors whose SaaS services we use.

15. Supplier Relations

Measures concerning information security to reduce risks related to suppliers' access to the company's assets should be agreed with sub-suppliers / subcontractors and documented.

Measures:

☒ Selection of the contractor under due diligence aspects (in particular with regard to data security).

Effective control rights vis-à-vis the contractor agreed.

Prior review and documentation of the security measures taken by the contractor.

☒ Obligation of the contractor's employees to maintain data secrecy.

☒ Ensuring the destruction of data after completion of the order.

16. Information security incident management

Consistent and effective measures for managing information security incidents (theft, system failure, etc.) shall be implemented.

Measures:

☒ Documented procedure for handling security incidents

☒ Immediate information of the client in the event of data protection incidents.

Involvement of the data protection and information security officer in the event of data protection incidents.

17. Information security aspects of business continuity management / emergency management

Maintaining system availability in difficult situations, such as crisis or damage events.

Emergency management must ensure this. The requirements regarding information security should be defined in the planning for business continuity and disaster recovery.

Measures:

☒ Use of redundant systems.

☒ Use of redundant systems at physically separate locations (e.g., emergency data center).

☒ Early information of the client in case of emergencies.

Corresponding measures are also carried out by our subcontractors whose SaaS services we use.

18. Compliance with legal and contractual requirements

Implement measures to prevent violations of legal, official or contractual obligations and any safety requirements.

Measures:

☒ Ensuring compliance with legal obligations within the scope of the cooperation.

☒ Return of all data, resources and information assets to the client at the end of the contract.

☒ Confidentiality obligations with employees as well as subcontractors and service providers.

19. Data protection requirements and data protection management

Privacy as well as protection of personal data should be ensured in accordance with the requirements of relevant legal regulations, other regulations as well as contractual provisions.

Measures:

☒ Directory of processing activities.

☒ Data protection impact assessment for processes that handle sensitive information/data.

☒ Establishment of a data protection management system.

☒ Data protection guidelines implemented.

‍

‍

‍

Die vorliegenden Allgemeinen Geschäftsbedingungen (AGB) gelten für die Leistungen der circuly GmbH, Obernstr. 50, 33602 Bielefeld (auch als "wir", "uns", "Service", "circuly" bezeichnet), die an Kunden (auch als "Kunde" oder "Sie" bezeichnet) bereitgestellt werden. Allgemeine Geschäftsbedingungen des Kunden finden keine Anwendung, es sei denn, wir stimmen der Geltung ausdrücklich zu. Mit unseren Leistungen und unseren AVB richten wir uns ausschließlich an Unternehmer im Sinne von § 14 BGB. Die im Lizenzvertrag getroffenen Vereinbarungen haben Vorrang und ersetzen die entsprechende/n Bestimmung/en in den AGB.

Präambel

Sofern Sie einen Lizenzvertrag mit uns über die Erbringung von Leistungen abgeschlossen haben oder Ihre Bestellung über unseren Bestellprozess samt anschließender Bestellbestätigung vorgenommen haben (insgesamt nachfolgend auch „Vertrag“ genannt), erwerben Sie vorbehaltlich besonderer Vereinbarungen im Lizenzvertrag, in Ihrer Bestellung oder im Angebot folgende Leistungen & Rechte. Sollten wir im Rahmen des Vertragsverhältnisses mit Ihnen personenbezogene Daten für Sie im Auftrag verarbeiten, erfolgt diese Verarbeitung auf Basis des Auftragsverarbeitungsvertrages gem. Art. 28 DSGVO („AVV“), der unmittelbar mit Wirksamwerden des Vertrages Geltung erlangt. Der jeweils geltende AVV ist auf unserer Website unter www.circuly.io/documents/data-processing-agreement hinterlegt.

§ 1 Vertragsgegenstand

Wir bieten mit circuly eine Software, die es Unternehmen ermöglicht ihre Produkte über E-commerce auch zu vermieten statt nur zu verkaufen. Mit unserer Subscription Management Software für physische Produkte unterstützen wir junge Unternehmen bei der Optimierung und Skalierung von bestehenden Miet-Modellen und helfen etablierten Unternehmen neue, Circular Business Models als zweites Standbein aufzubauen. Unsere Software ist eine White-Label Lösung, die entlang der kompletten Wertschöpfungskette im Mietmodell ein kunden-zentrisches Miet-Erlebnis schafft. Angefangen beim Online-Abschluss eines Mietbestellung, der Einrichtung wiederkehrender Zahlungen und Rechnungen, bis hin zur Verwaltung und Tracking aller Produkte durch den Anbieter im Backend. (nachfolgende in der Gesamtheit auch „Leistungen“ genannt). Die Leistungen aus diesem Vertrag können die unten genannten Bestandteile enthalten. Eine Übersicht über unsere Leistungen ergeben sich aus der Leistungsbeschreibung, die in ihrer jeweiligen Fassung auf unserer Website https://www.circuly.io/specification-of-services abrufbar oder aus dem Vertrag ersichtlich sind. Die konkreten Leistungsbestandteile, die wir im Vertragsverhältnis zu Ihnen erbringen, ergeben sich aus dem Lizenzvertrag, Ihrer Bestellung bzw. aus der Bestell-/Auftragsbestätigung.

SaaS Leistungen

1. Bei der Software handelt es sich um eine SaaS (Software as a Service) Lösung (nachfolgend auch „Software“, „Softwareleistungen“ oder „SaaS Leistungen“).
2. Die wesentlichen Funktionen beinhalten

• die Abwicklung und Verwaltung von Abo-Verträgen,
• die Einrichtung von wiederkehrenden Zahlungsströmen und Rechnungen,
• die Funktion eines Inventory Management, Asset Tracking und Retourenprozesses.

3. Durch die flexible Software Architektur und einem flexiblen Lizenzmodell kann die Software individuell an jeden Kunden und dessen jeweilige IT-Infrastruktur angepasst werden.
4. Unsere Softwareleistungen stellen wir Ihnen im Rahmen eines „Subscription Models“, juristisch gesehen also als Mietsache, für die Dauer unserer Vertragsbeziehung zur Verfügung.
5. Die konkreten Leistungsbestandteile, die wir im Vertragsverhältnis zu Ihnen erbringen, ergeben sich aus dem Lizenzvertrag, Ihrer Bestellung bzw. aus der Bestell-/Auftragsbestätigung.
   

Dienstleistungen

Neben den SaaS Leistungen bieten wir Dienstleistungen (u.a. auch Projektleistungen), wie unter anderem Workshops, Customizing oder Beratungsleistungen im Zusammenhang mit dem Einsatz von circuly an. Wenn Sie bspw. eine individuelle Betreuung beim Einsatz von circuly wünschen (zum Beispiel durch Coaching-, Moderations- und Beratungsleistungen), ist dies über eine individuelle Vereinbarung über Leistungsinhalte und Vergütung im Vertrag sowie über das entsprechend erstellte Angebot möglich. Bei der Erbringung von Dienstleistungen wird unser Aufwand anhand der dafür angefallenen Personentage oder nach Stunden abgerechnet. Die Beauftragung geschieht in diesen Fällen als Beauftragung zur Erbringung von Dienstleistungen und wird gesondert vereinbart. Ein Erfolg ist bezüglich dieser zusätzlichen Leistungen nicht geschuldet.

Supportleistungen

1. Wir bieten für alle unsere Nutzer folgende Basis-Supportleistungen an:

• ein Security Monitoring zur rechtzeitigen Erkennung und Behebung von Sicherheitsschwachstellen,
• das Einspielen von Sicherheitsupdates,
• das Einspielen von Bug Fixes,
• die Information über Major-Updates (Upgrades).

2. Der Basis Support-Plan für circuly wird Ihnen für sämtliche gebuchten Module und Funktionalitäten zur Verfügung gestellt. Über diesen Basis-Support-Plan hinaus können erweiterte Support-Pläne für circuly gebucht werden (e.g. im Rahmen des circuly Full-Service Pakets). Hierzu kontaktieren Sie bitte Ihren Vertriebsansprechpartner. Diese Supportleistungen bestehen insbesondere aus

• Unterstützung bei der Installation oder Konfiguration von Software (Onboarding Support)
• Einweisung und Schulung von Mitarbeitern des Kunden
• Entwicklung von kundenspezifischen Anpassungen
• Support- und Pflege von Software, die individuell für Sie entwickelt wurde
• Beratung hinsichtlich des Einsatzes und der Anwendung der circuly Software Module
• Inanspruchnahme von Support- und Pflege-Leistungen bei Fehlern und Störungen, die nicht von uns zu vertreten sind
• Unterstützung bei der Rücksetzung von Passwörtern und bei der Eingabe von Benutzernamen
• Unterstützung bei Entsperrung des Benutzerkontos aufgrund falscher Anmeldeversuche

3. Die Leistungen unseres Supports können von Ihnen über verschiedene Wege in Anspruch genommen werden. Wir haben dazu mehrere Kommunikationskanäle eingerichtet. Wenn Sie unsere Support-Leistungen optimal in Anspruch nehmen wollen, sollten diese Kanäle in der nachfolgend beschriebenen Reihenfolge genutzt werden.

• Service Portal “circuly knowledge loop”: Unser Service Portal “circuly knowledge loop” ist die erste Anlaufstelle für alle aktuellen Informationen rund um die circuly Software. Das Service Portal “circuly knowledge loop” wird laufend erweitert und ist erreichbar unter https://knowledgeloop.circuly.io/ . Im “circuly knowledge loop” finden Sie u.a. folgende Informationen:

• Aktuelle Dokumentationen
• Schulungsmaterialien und Best Practice Beispiele
• Informationen zu Weiterentwicklungen

• circuly Service Desk: Support-Anfragen können über den circuly Service Desk gestellt werden. Der Zugang zum circuly Service Desk steht Ihnen im circuly Operations Backend zur Verfügung. Alle Anfragen werden in unser Ticketsystem übernommen, d. h. zu jeder neuen Support-Anfrage wird im Ticketsystem ein eigenes Support-Ticket erstellt. Sie erhalten von uns per E-Mail die zu dem neuen Ticket zugehörige Bearbeitungs-Nr. bzw. Ticket-Nr. Die Ticket-Nr. dient als Referenz zum Ticket und muss in der nachfolgenden Kommunikation weiterverwendet werden. Des Weiteren werden Sie über Updates und Statusveränderungen zu Ihrere Anfrage via E-Mail informiert. Diese Informationen können Sie außerdem jeder Zeit in Ihrem Service Desk Account einsehen. Eine Anfrage gilt erst dann als qualifiziert, wenn Sie im Ticketsystem alle erforderlichen Felder korrekt ausgefüllt haben und eine Bestätigungsmail mit der zugehörigen Ticket.Nr- erhalten haben, , wie im Abschnitt Qualifizierte Support-Anfrage beschrieben ist. Je detaillierter eine Anfrage den Support erreicht, desto schneller kann der Fall eingeordnet und bearbeitet werden.

§ 2 Vergütung für unsere SaaS Leistungen und Dienstleistungen

1. Unsere Leistungen erwerben Sie grds. zu den Konditionen des gewählten Preismodells bzw. nach den Konditionen des für Sie individuell erstellten Angebots oder den Festlegungen im Lizenzvertrag.
2. Unsere Dienstleistungen rechnen wir grds. nach Aufwand ab. Dazu berechnen wir einen Stundensatz pro Entwickler von 125€ (entspricht einem Tagessatz pro Entwickler von 1.000€).
3. Jede Vergütung versteht sich zzgl. Umsatzsteuer in gesetzlicher Höhe zum Zeitpunkt und am Ort der Erbringung der Leistung.
4. Die Vergütung für die von uns zu erbringenden Leistungen ist von Ihnen grds. jeweils im Voraus für den entsprechenden Vertragsmonat zu zahlen. Wenn vertraglich vereinbart, sind wir zudem berechtigt, Ihnen die jeweilige Vergütung für bis zu 12 Monate im Voraus in Rechnung zu stellen.
5. Unsere Rechnungen werden mit Zugang bei Ihnen fällig und sind ohne Abzüge innerhalb von 30 Kalendertagen auf unser in der Rechnung angegebenes Konto zu zahlen.
6. Reisekosten und Spesen sind gesondert zu vergüten. Haben die Parteien keine Festlegung getroffen erfolgt dies nach den im Zeitpunkt der Erbringung der Leistung geltenden steuerlichen Höchstsätzen.

§ 3 Laufzeit des Nutzungsvertrags über unsere SaaS Leistungen

1. Unter diesem Vertrag erwirbt der Kunde ein Nutzungsrecht an der Software gem. den Vereinbarungen dieses Vertrags für unbestimmte Zeit, beginnend ab dem Datum der Unterzeichnung dieses Vertrags, mit einer Mindestvertragslaufzeit von 12 Monaten. Sollte keine der Parteien mit einer Frist von 4 Wochen zum Ende der Laufzeit kündigen, verlängert der Vertrag sich um jeweils einen Monat mit einer Kündigungsfrist von 4 Wochen zum Ende der jeweiligen Laufzeit. Die Kündigung kann in Textform erfolgen (E-mail ausreichend).
2. Ein Upgrade auf ein anderes Preismodells ist jederzeit mit Wirkung zum jeweiligen Folgemonat möglich. Ein Downgrade ist erst nach Ablauf der 12 monatigen Mindestlaufzeit möglich. Im Übrigen gelten die Regelungen des vereinbarten Preismodells. Eine Erstattung der für den laufenden Monat entrichteten/zu entrichtenden Kosten erfolgt nicht.
3. Mit Wirksamwerden der Kündigung wird der Zugang zu unseren Leistungen für Sie und Ihre Nutzer gesperrt. Gleichzeitig werden wir Ihnen unverzüglich sämtliche Daten, die auf dem Ihnen zugewiesenen Speicherplatz abgelegt sind, nach Ihrer Wahl durch Übergabe von Datenträgern oder durch Übersendung über ein Datennetz, herausgeben. . Unterstützungsleistungen im Zusammenhang mit der Kündigung können von uns auf Nachfrage und ggf. gegen gesonderte Vergütung erbracht werden.
4. Das Recht zur außerordentlichen Kündigung dieses Vertrags aus wichtigem Grund bleibt unberührt.          

§ 4 Grundsätze zur Erbringung unserer SaaS Leistungen und Dienstleistungen

1. Für die Inanspruchnahme unsere Software gelten die mietrechtlichen Vorschriften. Instandhaltungsmaßnahmen wie Updates, Patches, Hotfixes sind Bestandteil unserer Leistung. Ein weitergehender Support wird bei entsprechender Vereinbarung angeboten. Über die Instandhaltungsmaßnahmen hinaus findet das gesetzliche Mietmängel-Gewährleistungsrecht Anwendung.
2. Anpassungen, Änderungen und Ergänzungen der Software sowie Maßnahmen, die der Feststellung und Behebung von Funktionsstörungen dienen, werden nur dann zu einer vorübergehenden Unterbrechung oder Beeinträchtigung der Erreichbarkeit führen, wenn dies aus technischen Gründen zwingend notwendig ist. Größere Wartungsarbeiten, die zu einer Funktionsstörung der Software führen könnten, werden wir grds. außerhalb üblicher Geschäftszeiten erbringen.
3. Die Verfügbarkeit der Software nach diesem Vertrag beträgt 97,5 % im Jahresdurchschnitt einschließlich Wartungsarbeiten. Die Verfügbarkeit wird nicht länger als zwei Kalendertage in Folge beeinträchtigt oder unterbrochen sein.
4. Sie dürfen unsere Leistungen nicht an Dritte zur gewerblichen Nutzung überlassen.
5. Wir sind berechtigt, unsere Leistungen durch Dritte und Subunternehmen erbringen zu lassen.
6. Wir arbeiten kontinuierlich an der Verbesserung unseres Services und der Erweiterung unseres Leistungsumfangs. Wir behalten uns vor, unsere Leistungen sowie die hierauf bezogenen Dokumente und Anlagen unter Berücksichtigung Ihrer Interesse anzupassen und im Funktionsumfang zu erweitern. Sofern wir hierdurch nicht unsere vertraglich übernommenen Hauptleistungspflichten Ihnen gegenüber verletzten, behalten wir uns ebenfalls vor, den Funktionsumfang zu reduzieren. Über wesentliche und die Vertragsbeziehung mit Ihnen ändernde Modifikationen & Einstellungen werden wir Sie rechtzeitig vorab informieren. Sie haben das Recht, Änderungen zu widersprechen. Widersprechen Sie, werden wir gemeinsam versuchen, Alternativen zu finden. Werden diese nicht gefunden, haben beide Parteien das Recht, diesen Vertrag außerordentlich zu kündigen.
7. Bei höherer Gewalt sind wir für die entsprechende Dauer von unserer Pflicht zur Erbringung der Leistungen befreit, sofern uns die Leistungserbringung tatsächlich nicht möglich ist. Als höhere Gewalt gelten von uns oder von einem Subunternehmer nicht zu vertretendes Feuer, Explosion, Überschwemmung, Krieg, Blockade, Embargo, Pandemie und Arbeitskampfmaßnahmen.
8. Sie haben selbstständig angemessene Maßnahmen gegen den Verlust Ihrer Inhalte zu treffen.
9. Für das Handeln Ihrer Nutzer sind Sie verantwortlich und stehen hierfür wie für Ihr eigenes Handeln ein.
10. Über Links oder Funktionalitäten in unserer Software können Sie zu fremden Websites und Software gelangen, die nicht von uns betrieben werden und für die wir nicht verantwortlich sind. Solche Links oder Funktionalitäten sind entweder eindeutig gekennzeichnet oder durch einen Wechsel in der Adresszeile des Browsers oder eine Änderung der Benutzeroberfläche erkennbar.
11. Bei der Nutzung unserer Software ist es Ihnen untersagt:
    

• Schutzrechte Dritter wie Marken, Urheber- und Namensrechte zu verletzen,
• andere Kunden und Dritte zu belästigen,
• schadcodehafte oder virenbehaftete Dokumente, Dateien, IT-Systeme Dritter und Daten im Zusammenhang mit unseren Leistungen zu verwenden
• absprachewidrig über bereitgestellte Funktionalitäten und Schnittstellen hinausgehende Mechanismen, Software und Skripte einzusetzen, insbesondere wenn hierdurch unsere Leistungen blockiert, modifiziert, kopiert oder überschrieben werden, sowie
• unsere Services durch Datenveränderung (§ 303a StGB), Computersabotage (§ 303b StGB), Fälschung beweiserheblicher Daten (§ 269, 270 StGB), Unterdrückung beweiserheblicher Daten (§ 274 StGB), Computerbetrug (§ 263a StGB), Ausspähen von Daten (§ 202a StGB), Abfangen von Daten (§ 202b StGB) oder andere Straftaten zu beeinträchtigen.

§ 5 Ihre Mitwirkungspflichten für unsere SaaS Leistungen und Dienstleistungen

‍

Folgende Beistellungen und Mitwirkungen sind insbesondere von Ihnen als Nebenleistungspflichten kostenfrei uns gegenüber zu erbringen:

• Falls nicht existent, verpflichtet sich der Kunde einen Account bei einem Payment Service Provider (PSP) einzurichten, der von der circuly Software unterstützt wird. Alle aktuell unterstützen PSP sind in der Leistungsbeschreibung unter https://www.circuly.io/specification-of-services einsehbar.
• Falls nicht existent, verpflichtet sich der Kunde ein Shop System (CMS) zu nutzen, das von der circuly Software unterstützt wird. Alle aktuell unterstützen CMS sind in der Leistungsbeschreibung unter https://www.circuly.io/specification-of-services einsehbar.
• Der Kunde verpflichtet sich, uns die API Keys des/der Payment Service Providers (PSP) und des Shop Systems (CMS) zur Verfügung zu stellen.
• Offenlegung produktbezogener Daten wie z.B. Preise, Mietdauer, monatlicher Umsatz, etc. Die von uns für die Erbringung unserer Leistungen benötigten Daten gehen insbesondere aus der Liste „Overview of Data Points processed by circuly“ hervor (siehe hierfür unsere Leistungsbeschreibung unter https://www.circuly.io/specification-of-services)
• Einräumung von erforderlichen Nutzungsrechten an Software Dritter, insbesondere Datenbanken, Server-Betriebssysteme und Anwendungen.
• Falls notwendig: Erstellung von Backups des IT-Systems und anderen IT-Komponenten.
• Meldungen von Sach- und Rechtsmängeln sowie von Störungen müssen eine Problembeschreibung (z.B. mit Screenshots, anonymisierten Logfiles) enthalten.
• Mitteilung der bei Ihnen geltenden Richtlinien zum Fernzugriff auf Ihr IT-System.
• Zurverfügungstellung von Testfällen, Testdaten und Testumgebungen.
• Bei sicherheitsrelevanten Updates behalten wir uns vor, unsere Leistungen kurzfristig anzupassen. Daraus resultierende Anpassungen auf Ihren IT-Systemen sind von Ihnen vorzunehmen. Bei Bedarf leisten wir Ihnen hierbei Unterstützung.

§ 6 Allgemeine Haftung

1. Die Parteien haften für sich, ihre gesetzlichen Vertreter, Erfüllungsgehilfen und die von Ihnen eingeschalteten Subunternehmer/Vorlieferanten einander für von Ihnen verursachten, unmittelbaren Sach- und Vermögensschäden bis zu € 100.000 je Schadensereignis, maximal und unabhängig von der Anzahl der Schadensereignisse bis zu € 200.000 je Jahr der Vertragslaufzeit.
2. Bei einfacher Fahrlässigkeit ist die Haftung auf den vertragstypischen und vorhersehbaren Schaden beschränkt. Außerhalb der Verletzung wesentlicher Vertragspflichten ist die Haftung auf den Ersatz mittelbarer Sach- und Vermögensschäden, insbesondere entgangenen Gewinn, bei einfacher Fahrlässigkeit vollständig ausgeschlossen. Bei höherer Gewalt sowie bei unentgeltlicher Nutzung unserer Services ist unsere Haftung bei einfacher Fahrlässigkeit insgesamt ausgeschlossen. Vertragswesentliche Pflichten sind solche, deren Erfüllung die ordnungsgemäße Durchführung des Vertrags überhaupt erst ermöglicht und auf deren Erfüllung vertraut werden darf. Wir gehen davon aus, dass das Zweifache der von Ihnen jährlich gezahlten Vergütung im Kalenderjahr dem vorhersehbaren, typischerweise eintretenden Schaden entspricht.
3. Die Parteien haften der Höhe nach unbegrenzt bei der Verletzung von Leben, Körper oder Gesundheit sowie bei einem vorsätzlichen oder arglistigen Handeln. Gleiches gilt bei der schriftlichen Übernahme einer Garantie für die Beschaffenheit oder Haltbarkeit einer von uns zu erbringenden Leistung.
4. Unsere Haftung nach dem Produkthaftungsgesetz bleibt unberührt.
5. Sie haben für das Handeln Ihrer Mitarbeiter, gesetzlichen Vertreter, Erfüllungsgehilfen und etwaiger anderer Nutzer unserer Leistungen wie für eigenes Handeln einzustehen.

§ 7 Gewährleistung für unsere SaaS Leistungen

1. Bei Vorliegen von Sach- und Rechtsmängeln gelten vorbehaltlich der Festlegungen in dieser Ziffer die gesetzlichen Regelungen. Es gilt § 377 HGB. Sämtliche Mängelansprüche stehen unter der Bedingung Ihrer unverzüglichen Mängelanzeige gem. § 377 Abs. 1 und Abs. 3 HGB. Ihre Mängelanzeige hat schriftlich (elektronischen Form ausreichend) zu erfolgen.
   

Sachmängel

2. Bei Sachmängeln steht Ihnen nach unserer Wahl zunächst das Recht auf kostenfreie Nachbesserung oder Neulieferung (nachfolgend „Nacherfüllung“) zu. Kann der Mangel nach zweimaliger Nacherfüllung nicht behoben werden, ist vor einer etwaigen Kündigung bzw. einem Rücktritt zu prüfen, ob Ihren Interessen durch eine Alternativlösung entsprochen werden kann.
3. Bei Miete ist die verschuldensunabhängige Haftung auf Schadensersatz für bei Überlassung vorhandene Mängel aus § 536a Abs. 1 BGB ausgeschlossen.
   

Rechtsmängel

4. Unsere Leistungen werden Ihnen frei von Rechten Dritter verschafft. Bitte informieren Sie uns unverzüglich in Textform, wenn Sie Kenntnis über Rechte Dritter an unseren Leistungen erlangen.
5. Auf unser Verlangen haben Sie uns die Verteidigung gegen die von Dritten geltend gemachten Ansprüche zu überlassen, uns sämtliche hierfür notwendigen Informationen zur Verfügung stellen, Erklärungen zu erteilen und Befugnisse einzuräumen. Im Gegenzug stellen wir Sie von Zahlungs- und Schadensersatzansprüchen wegen der Rechte Dritter frei.
6. Sind unsere Leistungen tatsächlich mit Rechten Dritter belastet, sind wir nach unserer Wahl berechtigt,  

• die Rechter Dritter oder deren Geltendmachung zu beseitigen (z.B. durch Zahlung von Lizenzgebühren), oder
• unsere Leistungen in der Weise zu verändern, dass Rechte Dritter nicht mehr verletzt werden.
  

Allgemein

7. Mängelansprüche entfallen, wenn Sie ohne unsere vorherige Zustimmung Änderungen an den Leistungen vorgenommen haben oder wenn die Leistungen von Ihnen zu einem nicht von diesem Vertrag gedeckten Zweck eingesetzt werden und diese Handlung für das Auftreten des Mangels allein verantwortlich ist.
8. Sämtliche Ansprüche wegen Mängeln verjähren, sofern sie nicht ohnehin schon nach den vorgenannten Regelungen beschränkt oder ausgeschlossen sind, in 12 Monaten.

§ 8 Übertragung auf Dritte

1. Wir sind berechtigt, ohne Ihre Zustimmung den Vertrag auf einen Rechtsnachfolger oder ein mit uns verbundenes Unternehmen zu übertragen. Hierüber werden wir Sie in Textform mindestens zwei Monate vor der geplanten Übertragung informieren.
2. Eine Übertragung des Vertrags auf einen Dritten bedarf Ihrer vorherigen Zustimmung. Im Falle Ihres Widerspruchs wird der Vertrag unverändert fortgeführt. Der Widerspruch gilt als wichtiger Grund zur außerordentlichen Kündigung des Vertrags durch uns.

§ 9 Geheimhaltung

1. Im Rahmen der Zusammenarbeit erlangen beide Parteien Kenntnis von Geschäftsgeheimnissen der jeweils anderen Partei oder Dritten. Ein Geschäftsgeheimnis ist eine Information, die den Personen, die üblicherweise mit dieser Art von Informationen umgehen, weder allgemein bekannt noch ohne Weiteres zugänglich ist, daher von wirtschaftlichem Wert ist und die somit Gegenstand von angemessenen Geheimhaltungsmaßnahmen ist (vgl. § 2 GeschGehG). Ein Geschäftsgeheimnis ist weiterhin eine Information, die als Geschäftsgeheimnis gekennzeichnet ist, die durch gewerbliche Schutzrechte oder das Urheberrecht geschützt ist, die unter das Bankgeheimnis oder den Datenschutz fällt und bei der ein berechtigtes Interesse an der Geheimhaltung besteht. Kein Geschäftsgeheimnis sind Informationen, die der jeweils anderen Partei vor der Offenlegung bekannt sind, die nach der Offenlegung der Öffentlichkeit ohne Mitwirkung der offengelegten Partei bekannt geworden sind, die die offengelegte Partei durch einen berechtigten Dritten erfahren hat und die die offengelegte Partei selbst entwickelt hat.
2. Die empfangende Partei, sowie alle, die bestimmungsgemäß mit Geschäftsgeheimnissen in Kontakt kommen, sind verpflichtet, die Geschäftsgeheimnisse streng vertraulich zu behandeln und nur zu nutzen oder Dritten und Beschäftigten offenzulegen, wenn dies im Zusammenhang mit dem Geschäftszweck erforderlich ist. Im Übrigen wird die empfangende Partei die Geschäftsgeheimnisse vor Kenntnisnahme Dritter schützen.
3. Gegenstände sowie Dateien oder sonstige unkörperliche Gegenstände, auf denen sich Geschäftsgeheimnisse befinden, sind auf Verlangen der offenlegenden Partei bzw. spätestens mit Beendigung der Vertragsbeziehungen unverzüglich zu löschen oder an die offenlegende Partei herauszugeben.
4. Wir haben das Recht, anonymisierte Kundendaten zur Analyse und Optimierung unserer eigenen Services anzufragen.

§ 10 Schlussbestimmungen

1. Die Abtretung von einzelnen Ansprüchen aus diesem Vertrag bedarf der vorherigen Zustimmung der jeweils anderen Partei in Textform. Die Abtretung von Geldforderungen ist hiervon ausgenommen.
2. Auf die gesamte Vertragsbeziehung der Parteien findet ausschließlich das Recht der Bundesrepublik Deutschland unter Ausschluss des UN-Kaufrechts Anwendung.
3. Gerichtsstand für alle sich aus der Vertragsbeziehung ergebenden Streitigkeiten, ist das sachlich zuständige Gericht an unserem Sitz.
4. Im Falle von Streitigkeiten aus der Vertragsbeziehung werden die Parteien versuchen, sich in außergerichtlichen Verhandlungen gütlich zu einigen. Sollte eine außergerichtliche Einigung zwischen den Parteien nicht zu einem für beide Seiten befriedigenden Ergebnis führen, so haben sie vor Anrufung eines Gerichts eine Mediation nach der DIS-Mediationsordnung 10 durchzuführen. Bis zum Scheitern der Durchführung einer Mediation ist die Anrufung des Gerichts nicht zulässig.
5. Änderungen und Ergänzungen dieses Vertrags bedürfen zu ihrer Wirksamkeit der Textform. Änderungen des Vertrags werden wirksam, wenn Sie einer Änderung nicht innerhalb eines Monats nach Zugang einer Änderungsmitteilung in Textform widersprechen und wir Sie vorab auf Ihr Widerspruchsrecht hingewiesen haben. Widersprechen Sie der Änderung, gilt der Vertrag unverändert weiter und wir sind zur außerordentlichen Kündigung des Vertrags mit einer Frist von einem Monat zum Ende des nächsten Kalendermonats berechtigt. Die Textform gilt auch für eine Änderung dieser Formklausel. Der Vorrang individueller Nebenabreden bleibt unberührt.
6. Sollte eine der Bestimmungen des Vertrags unwirksam sein oder der Vertrag eine regelungsbedürftige Lücke enthalten, berührt dies die Wirksamkeit der übrigen oder lückenhaften Bestimmungen nicht. Die Parteien verpflichten sich in diesem Fall, die unwirksamen oder lückenhaften Bestimmungen durch wirtschaftlich den unwirksamen oder lückenhaften Bestimmungen am Nächsten kommende Bestimmungen zu ersetzen bzw. zu vervollständigen.

‍

‍

‍

These General Terms and Conditions (GTC) apply to the services of circuly GmbH, Obernstr. 50, 33602 Bielefeld, Germany (also referred to as "we", "us", "service", "circuly"), which are provided to customers (also referred to as "customer" or "you"). The customer's general terms and conditions of business shall not apply unless we expressly agree to their application. Our services and our GTC are directed exclusively at companies within the meaning of § 14 BGB. A specific agreement of the parties made in the licensing agreement supersedes the respective provision fo the GTC.

‍

Preamble

If you have concluded a license agreement with us for the provision of services or have placed your order via our order process including the subsequent order confirmation (hereinafter also referred to as "Agreement"), you acquire the following services and rights subject to special agreements in the license agreement, in your order or in the offer. If we process personal data on your behalf within the scope of the contractual relationship with you, this processing shall be carried out on the basis of the Data Processing Agreement pursuant to Art. 28 DSGVO ("DPA"), which shall apply immediately when the Agreement becomes effective. The applicable DPA is available on our website at www.circuly.io/documents/data-processing-agreement.

§ 1 Subject of the contract

With circuly, we offer software that enables companies to rent out their products via e-commerce instead of just selling them. With our subscription management software for physical products, we support young companies in optimizing and scaling existing rental models and help established companies to establish new circular business models as a second pillar. Our software is a white-label solution that creates a customer-centric rental experience along the complete value chain in the rental model. Starting with the online conclusion of a rental order, the setup of recurring payments and invoices, up to the management and tracking of all products by the provider in the backend. (hereinafter collectively also referred to as "Services"). The Services under this Agreement may include the components listed below. An overview of our services can be found in the service description, which is available in its respective version on our website https://www.circuly.io/specification-of-services or can be found in the contract. The specific service components that we provide in the contractual relationship with you result from the license agreement, your order or the order/order confirmation.

SaaS Services

1. The software is a SaaS (Software as a Service) solution.
2. The main functions include

• the management of subscription contracts
• the establishment of recurring payments and invoices
• functionality of inventory management, asset tracking and return handling.

3. Thanks to the flexible software architecture and a flexible licensing model, the software can be individually adapted to each customer and their respective IT infrastructure.
4. We make our software services available to you within the framework of a "subscription model", i.e. legally as rented property, for the duration of our contractual relationship.
5. The concrete service components that we provide in the contractual relationship with you result from the license agreement, your order or the order/order confirmation.

‍
‍

Additional Services

6. Besides the SaaS services, we offer services (including project services), such as workshops, customizing or consulting services in connection with the use of the circuly software. If, for example, you would like a development of customized integrations or individual support when using circuly (e.g. through coaching, moderation and consulting services), this is possible through an individual agreement and corresponding offer on the service content.
7. The remuneration is then set in an additional contract. When providing services, our expenses are invoiced on the basis of the man-days or hours worked. In these cases, the order needs to be agreed on separately. A success is not owed with regard to these additional services.
   

Support

8. We offer the following support for our users:

• Security Monitoring for timely detection and remediation of security vulnerabilities,
• the installation of security updates,
• the installation of Bug Fixes,
• the information about Major-Updates (and upgrades).

9. The basic support plan for circuly is provided to you for all booked modules and functionalities. Beyond this basic support plan, extended support plans for circuly can be booked (e.g. within the scope of the circuly full service package). For this purpose, please contact your sales contact person. These support services consist in particular of

• Support with the installation or configuration of software (onboarding support)
• Instruction and training of customer's employees
• Development of customer-specific adaptations
• Support and maintenance of software that has been developed individually for you
• Consulting regarding the use and application of circuly software modules
• Claiming support and maintenance services in case of errors and malfunctions for which we are not responsible
• Support in resetting passwords and entering user names
• Support in case of unblocking of the user account due to wrong login attempts

10. You can make use of our support services in various ways. We have set up several communication channels for this purpose. If you want to make optimal use of our support services, these channels should be used in the order described below:

1. Service Portal “circuly knowledge loop”: Our service portal "circuly knowledge loop" is the first point of contact for all current information about circuly software. The service portal "circuly knowledge loop" is constantly being expanded and can be reached at https://knowledgeloop.circuly.io/ . In the "circuly knowledge loop" you will find the following information, among others:

• Current documentation
• Training materials and best practice examples
• Information on further developments

2. circuly Service Desk: Support requests can be made via the circuly Service Desk. Access to the circuly Service Desk is available in the circuly Operations backend. All requests are transferred to our ticket system, i.e. for each new support request a separate support ticket is created in the ticket system. You will receive an e-mail from us with the processing number or ticket number associated with the new ticket. The ticket number serves as a reference to the ticket and must be used in subsequent communication. Furthermore, you will be informed about updates and status changes to your request via e-mail. You can also view this information at any time in your Service Desk account. A request is only considered qualified when you have correctly filled in all required fields in the ticket system and received a confirmation e-mail with the corresponding ticket number, as described in the section Qualified Support Request. The more detailed a request reaches Support, the faster the case can be classified and processed.

‍

‍

‍

‍

§ 2 Remuneration for our SaaS performance and additional services

1. You generally purchase our services at the conditions of the selected price model or according to the conditions of the offer created individually for you or the stipulations in the license agreement.
2. We generally charge for our additional services on a time and material basis. For this purpose we charge an hourly rate per developer of 125€ (corresponds to a daily rate per developer of 1.000€).
3. Any remuneration is subject to value added tax at the statutory rate applicable at the time and place of performance of the service.
4. The remuneration for the services to be rendered by us is to be paid by you in advance for the respective contractual month. If agreed on in the Licensing Agreement, we are also entitled to invoice you for the respective remuneration for up to 12 months in advance.
5. Our invoices are due upon receipt by you and are payable without deductions within 30 calendar days to our account specified in the invoice.
6. Travel costs and expenses are to be reimbursed separately. If the parties have not agreed, this will be done according to the maximum tax rates applicable at the time of performance of the service.

‍

‍

§ 3 Duration of contract for our SaaS services

1. Under this agreement, the Customer acquires the right to use the software in accordance with this agreement for an indefinite period of time, beginning on the date the licensing agreement is signed, with a minimum duration of 12 months. Should neither party terminate with a notice period of 4 weeks towards the end of the term, the agreement shall be extended by one month at a time with a notice period of 4 weeks to the end of the respective term. The termination can be made in text form (e-mail is sufficient).
2. An upgrade to another price model is possible at any time with effect from the respective following month. A downgrade is only possible after the 12-month minimum term has expired. In all other respects, the provisions of the agreed price model shall apply. A refund of the costs paid/to be paid for the current month will not be made.
3. When the cancellation becomes effective, access to our services will be blocked for you and your users. At the same time, we will immediately return to you all data stored on the storage space allocated to you, at your option by handing over data carriers or by sending them via a data network. Support services in connection with the termination can be provided by us upon request and, if necessary, for a separate fee.
4. The right to extraordinary termination of this contract for good cause remains unaffected.          

‍

‍

‍

§ 4 Prerequisites for providing our SaaS services

1. The provisions of rental law apply to the use of our software. Maintenance measures such as updates, patches, hotfixes are part of our service. Further support is offered upon corresponding agreement. Beyond the maintenance measures, the legal rental defect warranty law applies.
2. Adjustments, changes and additions to the software as well as measures that serve to determine and remedy malfunctions will only lead to a temporary interruption or impairment of accessibility if this is absolutely necessary for technical reasons. Major maintenance work that could lead to a malfunction of the software will generally be performed by us outside normal business hours.
3. The availability of the Software under this Agreement shall be 97.5% on an annual average including maintenance work. Availability will not be impaired or interrupted for more than two calendar days in succession.
4. You may not transfer our services to third parties for commercial use.
5. We are entitled to have our services provided by third parties and subcontractors.
6. We are continuously working on the improvement of our service and the expansion of our scope of services. We reserve the right to adapt our services as well as the documents and attachments related thereto and to expand the scope of functions, taking into account your interests. We also reserve the right to reduce the scope of functions, provided that we do not violate our main contractual obligations to you. We will inform you in good time in advance about significant modifications and settings that change the contractual relationship with you. You have the right to object to modifications. If you object, we will jointly try to find alternatives. If these are not found, both parties have the right to terminate this contract extraordinarily.
7. In the event of force majeure, we shall be released from our obligation to provide the services for the corresponding duration, provided that it is actually impossible for us to provide the services. Force majeure is defined as fire, explosion, flood, war, blockade, embargo, pandemic and industrial action for which we or a subcontractor are not responsible.
8. You shall independently take reasonable measures against the loss of Your Content.
9. You are responsible for the actions of your users and are responsible for them as you are for your own actions.
10. Links or functionality in our software may take you to third-party websites and software that are not operated by us and for which we are not responsible. Such links or functionalities are either clearly marked or recognizable by a change in the address line of the browser or a change in the user interface.
11. When using our software, you are prohibited from:
    

• violating third party property rights such as trademarks, copyrights and rights to a name,
• harassing other customers and third parties
• using documents, files, IT systems of third parties and data in connection with our services that contain malicious code or viruses
• using mechanisms, software and scripts that go beyond the functionalities and interfaces provided in breach of the agreement, in particular if our services are blocked, modified, copied or overwritten as a result, as well as
• interfering with our services by altering data (§ 303a StGB), computer sabotage (§ 303b StGB), falsification of data relevant to evidence (§ 269, 270 StGB), suppression of data relevant to evidence (§ 274 StGB), computer fraud (§ 263a StGB), spying out data (§ 202a StGB), interception of data (§ 202b StGB) or other criminal acts.

‍

‍

‍

‍

‍

‍

‍

§ 5 Your obligations to cooperate for our SaaS services

‍

The following provisions and cooperation are to be provided free of charge to us in particular by you as ancillary obligations:

• If not existing, the Customer undertakes to set up an account with a Payment Service Provider (PSP) that is supported by the circuly software. All currently supported PSPs can be viewed in the service description at https://www.circuly.io/specification-of-services.
• If not existing, the Customer undertakes to use a e-commerce shop system (CMS) supported by the circuly Software. All currently supported CMS can be viewed in the service description at https://www.circuly.io/specification-of-services.
• The Customer undertakes to provide us with the API Keys of the Payment Service Provider(s) (PSP) and the Shop System (CMS).
• Disclosure of product-related data such as prices, rental period, monthly turnover, etc. The data required by us for the provision of our services can be seen in particular from the list "Overview of Data Points processed by circuly" (for this, see our service description at https://www.circuly.io/specification-of-services).
• Granting of necessary rights of use to third party software, in particular databases, server operating systems and applications.
• If necessary: Creation of backups of the IT system and other IT components.
• Notifications of material defects, defects of title and malfunctions must include a description of the problem (e.g. with screenshots, anonymized log files).
• Notification of the guidelines applicable to remote access to your IT system.
• Provision of test cases, test data and test environments.
• In the event of security-relevant updates, we reserve the right to adjust our services at short notice. Any resulting adjustments to your IT systems must be made by you. If required, we will provide you with support in this regard.

‍

‍

‍

§ 6 General liability

1. The parties shall be liable to each other for themselves, their legal representatives, vicarious agents and the subcontractors/pre-suppliers engaged by you for direct property damage and financial loss caused by you up to € 100,000 per damaging event, up to a maximum of € 200,000 per year of the contract term, irrespective of the number of damaging events.
2. In the event of simple negligence, liability shall be limited to the foreseeable damage typical of the contract. Outside the breach of essential contractual obligations, liability for compensation for indirect material and financial damage, in particular loss of profit, is completely excluded in the case of simple negligence. In case of force majeure as well as in case of gratuitous use of our services, our liability is excluded altogether in case of simple negligence. We assume that twice the annual compensation paid by you in a calendar year corresponds to the foreseeable, typically occurring damage.
3. The parties shall be liable to an unlimited extent in the event of injury to life, body or health as well as in the event of intentional or fraudulent acts. The same shall apply in the event of the written assumption of a guarantee for the quality or durability of a service to be provided by us.
4. Our liability under the Product Liability Act remains unaffected.
5. You shall be liable for the actions of your employees, legal representatives, vicarious agents and any other users of our services as for your own actions.

‍

‍

‍

§ 7 Warranty for our SaaS services

1. In the event of material defects and defects of title, the statutory provisions shall apply subject to the provisions of this clause. Section 377 of the German Commercial Code (HGB) shall apply. All claims for defects are subject to the condition of your immediate notification of defects in accordance with § 377 para. 1 and para. 3 HGB. Your notification of defects must be made in writing (electronic form is sufficient).
   

Material defect

2. In the event of material defects, you shall first have the right, at our discretion, to free rectification or new delivery (hereinafter referred to as "subsequent performance"). If the defect cannot be remedied after two attempts at subsequent performance, it shall be examined whether your interests can be met by an alternative solution before any termination or withdrawal.
3. In the case of rent, strict liability for damages for defects existing at the time of transfer is excluded under Section 536a (1) of the German Civil Code (BGB).
   

Legal defects

4. Our services are provided to you free from the rights of third parties. Please inform us immediately in text form if you become aware of third party rights to our services.
5. At our request, you must leave the defence against claims asserted by third parties to us, provide us with all information necessary for this purpose, provide explanations and grant us authority. In return, we shall indemnify you against claims for payment and damages based on the rights of third parties.
6. If our services are actually encumbered with third-party rights, we shall be entitled to choose,  

• eliminate the rights of third parties or their assertion (e.g. by payment of royalties), or
• to modify our services in such a way that the rights of third parties are no longer infringed.
  

General

7. Claims for defects shall not apply if you have made changes to the services without our prior consent or if the services are used by you for a purpose not covered by this contract and this action is solely responsible for the occurrence of the defect.
8. All claims for defects shall become statute-barred after 12 months, unless they are already limited or excluded under the aforementioned provisions.

‍

‍

§ 8 Transfer to third parties

1. We are entitled to transfer the contract to a legal successor or a group company affiliated with us without your consent. We will inform you of this in text form at least two months before the planned transfer.
2. A transfer of the contract to a third party requires your prior consent. In the event of your objection, the contract will continue unchanged. The objection shall be deemed an important reason for the extraordinary termination of the contract by us.

‍

‍

§ 9 Confidentiality

1. In the course of the cooperation, both parties gain knowledge of trade secrets of the other party or third parties. A trade secret is information which is neither generally known nor readily accessible to persons who normally handle this type of information, is therefore of economic value and is therefore subject to appropriate secrecy measures (cf. Section 2 GeschGehG). Furthermore, a trade secret is information which is marked as a trade secret, which is protected by industrial property rights or copyright, which is covered by banking secrecy or data protection and for which there is a justified interest in secrecy. A trade secret shall not be information which is known to the respective other party prior to disclosure, which has become known to the public after disclosure without the involvement of the disclosed party, which the disclosed party has learned through an authorized third party and which the disclosed party has developed itself.
2. The Receiving Party, as well as all those who come into contact with trade secrets as intended, are obliged to treat the trade secrets as strictly confidential and only to use them or disclose them to third parties and employees if this is necessary in connection with the business purpose. In all other respects, the receiving party shall protect the trade secrets from disclosure to third parties.
3. Objects as well as files or other incorporeal objects on which trade secrets are located shall be deleted or handed over to the disclosing party immediately upon request of the disclosing party or at the latest upon termination of the contractual relationship.
4. We have the right to request anonymized customer data for the analysis and optimization of our own services.

‍

‍

‍

‍

§ 10 Final provisions

1. The assignment of individual claims arising from this contract requires the prior consent of the respective other party in text form. The assignment of monetary claims is excluded from this.
2. The entire contractual relationship between the parties shall be governed exclusively by the laws of the Federal Republic of Germany, to the exclusion of the UN Convention on Contracts for the International Sale of Goods.
3. The place of jurisdiction for all disputes arising from the contractual relationship shall be the court with subject-matter jurisdiction at our registered office.
4. In the event of disputes arising from the contractual relationship, the parties shall attempt to reach an amicable settlement in out-of-court negotiations. If an out-of-court settlement between the parties does not lead to a mutually satisfactory result, they shall conduct mediation in accordance with the DIS Mediation Rules 10 before resorting to court. Until the failure of the execution of mediation, recourse to the court shall not be permissible.
5. Amendments and supplements to this Agreement must be made in text form to be effective. Amendments to the contract shall become effective if you do not object to an amendment in text form within one month of receipt of a notice of amendment and we have informed you in advance of your right to object. If you object to the amendment, the contract shall continue to apply unchanged and we shall be entitled to extraordinary termination of the contract with one month's notice to the end of the next calendar month. The text form also applies to an amendment of this form clause. The priority of individual ancillary agreements remains unaffected.
6. Should one of the provisions of the contract be invalid or should the contract contain a loophole requiring regulation, this shall not affect the validity of the remaining or loophole provisions. In this case, the parties undertake to replace or complete the invalid or incomplete provisions with provisions that come closest in economic terms to the invalid or incomplete provisions.

‍